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About STELLARWIND and other mysterious 
classification markings 

(Updated: September 15, 2014) 

Last week, on September 6, the US Justice Department released a declassified version 
of a 2004 memorandum about the STELLARWIND program. 

The memorandum (pdf) is about the legality of STELLARWIND, which was a program 
under which NSA was authorized to collect content and metadata without the warrants 
that were needed previously. 

Here we will not discuss the STELLARWIND program itself, but take a close look at the 
STELLARWIND classification marking, which causes some confusion. Also we learn 
about the existance of mysterious compartments that point to some highly sensitive 
but yet undisclosed interception programs. 

> See also: The US Classification System 
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The redacted markings 


The first thing we see is that two portions of the classification marking have been 
blacked out: 


1. The redacted space beween two double slashes 

This is very strange, because according to the official classification manuals, there 
cannot be something between two double slashes in that position (see the chart 
below). The classification level (in this case: Top Secret) has to be followed by the 
Sensitive Compartmented Information (SCI) control system (here: COMINT). 

But as the US classification system is very complex, there are often minor mistakes in 
such classification lines. If we assume there was a mistake made here too, then the 
first term that has been blacked out could be another SCI compartment, which had to 
be followed by just a single slash (for example HCS for HUMINT Control System would 
fit the redacted space, although that marking itself isn't classified). 

If there was no mistake, however, and the double slash is actually correct, then it 
would be a complete new category which isn't in the (public) classification manuals. 
This reminds of the UMBRA marking, which also appeared unexpectedly between 
double slashes in a classification line. 
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Overview of the categories and formatting for the US classification and control markings 
From the Intelligence Community Classification Manual 6.0 from December 2013 
(click to enlarge) 


2. The redacted space directly after STELLARWI ND 

The second redaction starts right after the last letter of "STELLARWIND", thereby 
carefully hiding the category of the redacted marking, which is determined by how it is 
separated from the previous term. This could be by a slash, a double slash, a hyphen 
or a space, each indicating a different level. 
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In this case, the most likely option is that "STELLARWIND" is followed by a hyphen, 
which indicates the next term is another compartment under the COMINT control 
system, equal to STELLARWIND. 

Classification manuals say there are undisclosed COMINT compartments which have 
identifiers consisting of three alphabetical characters. This would fit the redacted space 
as it would read like: "COMI NT-STELLARWI ND-ABC". 
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This undisclosed compartment probably also figured in some other declassified 
documents, where it sometimes seems to be accompanied by a sub-compartment 
which is identified by three numeric characters, like for example in this and this 
declaration where the marking could read like "COMINT-ABC 678": 



Classified declaration of NSA director Alexander, April 20, 2007. 
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Looking at what was redacted in portions of both documents which were marked with 
this mysterious compartment, it seems that it's about at least two highly sensitive 
intelligence sources and methods. For example, pages 31-32 of this declaration (pdf) 
suggest that this might be obtaining metadata from specific telecom companies and 
search them for members or agents of particular target groups. 


Case4:08-cv-04373-JSW Document222 Filed05/05/14 Page8of31 

Approved for public release May 5. 2014 
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"COMI NT-STELLAR WIND" and according to the official formatting rules, this means 
that STELLARWIND would be part of the COMI NT control system. 

Note that the same memorandum had already been declassified upon a FOIA request by the ACLU in 2011, but 
in that version (pdf) the codeword STELLARWIND was still blacked out from the whole document. Both 
documents are compared here. 


U.S. Department of Justice 
Office of Legal Counsel 


US Red Phones 




Office or rtie A5sisl£uu Attorney General 


Jfodinjf/w. D.C. 20310 

May 6, 200-1 


Classification marking of the 2004 DoJ memorandum about STELLARWIND 


As COMI NT is a control system for communications intercepts or Signals Intelligence, 
this seems to make sense. But what is confusing, is that the internal 2009 NSA 
classification guide (pdf) for the STELLARWIND program, which was disclosed by 
Edward Snowden, says something different. 

Initially this guide calls STELLARWIND a "special compartment", but from the marking 
rules it becomes clear that it is treated as an SCI control system. Accordingly, the 
prescribed abbreviated marking reads: "TOP SECRET // STLW / SI // ORCON / 
NOFORN". In this way we can see STELLARWIND in the classification line of the 
following document: 


Sequence of the real Red Phones, not 
for the Washington-Moscow Hotline, 
but for the US Defense Red Switch 
Network (DRSN). The phones shown 
here were in use from the early 
eighties up to the present day and 
most of them were made by 
Electrospace Systems Inc. They will be 
discussed on this weblog later. 

For the record, you see: 

- Electrospace MLP-1 

- Electrospace MLP-1 A (since 1983) 

- Electrospace MLP-2 

- Raytheon 1ST (since 1992) 

- Telecore IST-2 (since 2003) 
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tS> " tSWSWSEJ^Pinwraiit to the standards in Executive Order (E.O.) 1 .1526, this 
declaration is classified as: TOP 5 BC i tET/CTU TO^^ ^ ICS// OltCOW/NOTOKN. The 
details concerning these classification marking* are set forth in the Classified NSA Declaration 
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Color codes for the classification levels 
used by the government and the 
armed forces of the Unites States: 



Confidential 


In this document and also in a similar declaration (pdf) from 2013, the reason for the 
STELLARWIND classification is explained as follows: 

"This declaration also contains information related to or derived from the 
STELLARWIND program, a controlled access signals intelligence program 
under presidential authorization in response to the attacks of September 
11, 2001. In this declaration, information pertaining to the STELLARWIND 
program is denoted with the special marking "STLW" and requires more 
restrictive handling." 


These color codes are used to mark 
the classification level of (digital) 
documents and files and also of the 
communication devices used for their 
transmission. 


STELLARWIND is also being treated as a control system in the 2009 draft report about 
this program written by the NSA Inspector General, although its classification line is 
also somewhat sloppy: there are double slashes between STLW and COMI NT (should 
just be a single one), and only a single one between COMI NT and ORCON (where 
there should have been double slashes as both are from different categories): 
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TOPSECRET//STLW//C0MINT/ORCON/NOFORN 

ST-09-0002 WORKING DRA FT 
OFFICE OF THE INSPECTOR GENERAL 

NATIONAL SECURITY AGKNCY 
CRNTRAL SECURITY SERVICE 


24 March 2009 


Classification marking of the 2009 report about 
STELLARWI ND by the NSA Inspector General 
(click to read the full document) 


Throughout this document, the portion markings are also not always consistent. Most 
of them are "TS//SI//STLW//NF", but one or two times "TS//SI -STLW//NF". But as this 
report is a draft, it's possible that these things have been corrected in the final 
version, which hasn't been disclosed or declassified yet. 

The 2009 Inspector General report about STELLARWI ND was one of the first 
documents from the Snowden-leaks to be published, and it still is one of the most 
informative and detailed pieces about the development of NSA's interception efforts 
since 9/11. 


Conclusion 

In the end, it doesn't make much difference whether STELLARWI ND is a control 
system on its own, or a sub-system of COMINT, but it is remarkable that for such an 
important program, the people involved apparently also weren't clear about it's exact 
status and how to put it in the right place of a classification line. 

More important though is that the declassified documents show that besides the 
STELLARWI ND program, there's at least one COMI NT-compartment with at least one 
sub-compartment that protect similar or related NSA collection efforts which are 
considered even more sensitive, but about which we can only speculate. 
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2 continents: 

CityWolf said... 

B This comment has been removed by the author. 
September 16, 2014 at 5:28 PM 

rsesek said... 

° My hypothesis is that STELLARWI ND started as an highly classified COMINT 
compartment, which is what the early documents show. The entire STLW 
system was set up under emergency legal powers after 9/11, so the legal 
framework for the collection was not long-lasting. But then the Executive 
Branch got FISA amended (a couple of times...) to grant power to collect in 
a STLW-like way. The FISA-based legal framework is somewhat different 
than what STLW was originally set up to do, and the IG report shows that 
STLW collected data in some legally questionable ways. I think that after 
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this weblog is obtained from 
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FISA was updated, STELLARWIND was made a control system to protect 
and isolate the data collected under that temporary, emergency authority, 
which is why the classification guides are so explicit about not removing 
information from the control system. Data collected under the authority is 
collected in an SI compartment, just like STLW was originally. 


Also, one note: HCS (and other control system markings) are sometimes 
redacted so that a document is not associated with an agency, not because 
the marking itself is classified. 

September 16, 2014 at 5:34 PM 
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